I'm not sure that it is practical to make vibe coding secure enough by default to be called secure by default. You could hang linters of the process and use the

I'm not sure that it is practical to make vibe coding secure enough by default to be called secure by default. You could hang linters of the process and use the results to refine your LLM prompts (perhaps even in an automated manner to an extent), but that'll never be perfect. The LLMs people are using were trained with public code, and that public code has many security issues that may be repeated by the LLM along with the good stuff, and new classes of problem pop up regularly so you have to keep those linters up-to-date which somehow avoid false positives that might cause them to flag decent code and accidentally cause a reprompt in a way that makes it worse. Vibe coding is just outsourcing, just not directly to other humans, or like giving tasks to an enthusiastic but somewhat bumbling junior dev —¹ you have to verify the results for security issues, style matters, and just to make sure it actually works, whether you have pushed the task to a local human, a remote human, or an environment munching LLM, before using it. -------- [1] Oh no! An em-dash! Am I an AI and nobody has told me?!